One Identity Active Roles Reviews

We use it to lock down the interface between helpdesks and Active Directory.

It's improved things because we don't have "cowboy changes" being made to AD without us knowing about it. People still have to do the things they need to do, but we can now make sure that they don't inadvertently do something they shouldn't.

It hasn't saved us time in terms of what needs to be done, but it has saved us time in terms of not having to go back and fix stuff when people have made mistakes.

It gives us attribute-level control and the AD management features work very well.

For what we use it for, there are no additional features it would need.

Most of the time it just works.

It works at the scale we use it at. I can't say whether it would work in much bigger enterprises or not.

I, personally, have never had cause to use technical support. My guys have interacted with them a few times and have been happy with the support they've received.

Previously, people were able to update AD directly. We have reduced that by pushing everything through Active Roles. Our decision to go with this solution was part of the need to lock things down, make things more secure.

We did the deployment ourselves.

My advice would be to certainly consider Active Roles and, depending on the size of the organization, consider integrating it with Starling as well.

I know the solution is extensible through cloud-delivered services but we don't use those currently.

I would rate Active Roles a nine out of ten, based on the convenience it's given us.

We primarily use it for delegation access permissions, to helpdesks for example. We use it to automate certain things, like onboarding new users, deprovisioning leaving users, or when we add somebody to a group it triggers some kind of automation workflow. Lastly, we use it to sanitize data entry, to make sure that the first letter of the street name is capitalized, certain zip codes are allowed, others aren't; it's a type of data control.

It helps mitigate risks. With traditional, native Active Directory delegation, it can become really messy, really fast. You lose oversight on who has access where. We are an acquisitions and mergers company so we let go of certain companies and we onboard new ones. With native delegating, we can lose track of who has access and to what. With Active Roles, we can always see who has access, what they can do, in a very granular way. A user can modify the street name, but can't modify the city, for example; or can modify the picture, but not the names. That granularity is not normally available.

It has eliminated a lot of tedious IT tasks, especially when people leave. There are ten or 15 scripted actions that Active Roles does, always the same way and at the same time. Before, there would literally be a list of things that the admin would have to do, like hide the mailbox, disable the user, remove the groups, etc. Also, the auditing history that it keeps is very handy for us. It gives us a change record of what's been done to a user, who did it, when they did it, and that really helps out.

And now that we are outsourcing a lot of activities, we're dealing with a changing audience. Tools like this make sure that they do everything in a structured manner, that everybody does the same thing at the same time.

It's valuable to us in that it resembles the native tools that most people have grown accustomed to. Most people come from another company where they may have not used Active Roles. Active Roles resembles traditional tools, such as from Microsoft. That is really good because it eases the way people to interact with the tool.

The AD and AAD management features of this solution are really good. They're better than the native tools. They offer added value by showing more fields such as password age and the statuses of some things that we normally wouldn't see. What I really like is the fact that we have the mailbox and the user information all on one screen. With native tools, you need two tools to show that information.

Active Roles allows policies and there are a lot of example policies that come with it. It has Access Templates and there are a lot of Access Template examples in it. It also has workflows and those are really powerful, but there are no built-in workflows. When it comes to them, it's empty. I would personally love for it to come with ten, 15, or 20 workflows where each achieves a certain task but that are not enabled. I could just look at how each is done, clone them, copy them, modify them the way I want them, and be good to go. Right now we have to invent things from scratch.

It's very stable. Even if components lose connectivity or the database dies, as soon as they come back up, it just reconnects and goes.

It covers everything we want. It's scalable. We can make it redundant, we can replicate databases. We don't use a lot of those features, but it's very scalable.

The reason we went with this solution - and it was ten or 15 years ago - was the Active Directory delegation. We could not allow everyone to have native access to our Active Directory. The delegation feature was really the trigger. In addition, the automation was attractive. There was so much room for human error that we wanted to script activities, rather than relying on the admin knowing what to do.

It requires a bit of getting used to, where you set what. But once you get the hang of it, it's really straightforward.

The ROI is in the mitigation of risks: The risk of leaving unauthorized access behind, the risk of having Active Directory pollution. With that comes risks of people getting access they shouldn't have. There is the risk of having multiple accounts for the same thing; that's the biggest part. There's no actual money there, but risk management is really what you pay for.

We considered using the Microsoft solution because it's free and built-in, and already there. That's what everybody does. But when you grow beyond a certain size, you find out that it just does not cut it anymore. 

We also considered using other tools, but at the time, Active Roles was very much alone in this world. I have to admit, now there are other vendors available, which I don't have any personal experience with, but on paper, they seem to do some of the same things. But at the time, there was simply nothing else that could even come close.

I would give this solution a nine out of ten. There's always room for improvement. With every product, nothing is completely done. But this product is definitely up there.

RBAC for AD and Exchange

Provisioning, Re-provisioning, De-provisioning and Undo-De-Provisioning of user accounts

User Self Service

Virtual AD firewall

• Heavily Automates - it will automate the entire provisioning, re-provisioning, de-provisioning and undo-de-provisioning tasks
• Complete Audit Trail - it gives an audit trail for each and every activity
• Increase in accountability – various tasks can be enabled for approval.
• Virtual Firewall against AD/Exchange - it helps protect Active Directory and Exchange exposure to administrators and engineers
• Escalations – it helps escalates tasks if not acted upon in a stipulated time frame
• Security –
  • it helps in increased security as every employee will have correct resource access depending upon the business policies
  • user account is disabled and user is removed from the security groups which prevent misuse of user credentials

• Role Based Access Control
• Provisioning, Re-provisioning, De-provisioning and Undo-De-provisioning policies
• Data validation policies
• Workflows
  • If Then Else statements
  • Approval Workflows
  • Schedule Workflows
  • Escalation
• Virtual Schema
• Virtual OU’s
• Web console with easy customization option
• Integration and data synchronization with SQL, Office 365, Lync etc.
• Event handlers

• Web console – it should have more customization options in terms of look and feel of the landing page
• Workflow policies – Additional policies for folder access provisioning
• Bring back attestation – Attestation feature is dropped from ARS. This should be brought back

No issues encountered.

No issues encountered.

Customer Service:

It's good.

Technical Support:

It's good. In fact, the One Identity (Quest) support team has easy access to the One Identity (Quest) product developers. In case of any technical issues which has something to do with the product architecture or a bug, the support engineer brings in the developer in a remote session so that the developer understands the issue. The developer(s) then work on a patch to address the issue.

I did not use any other solution.

The initial setup is pretty straightforward. It's not at all complex.

Our company, Amal IT Solutions, is a One Identity (Quest) partner. Our consultancy has 10+ years of experience with this solution.

I won’t be able to provide ROI from commercial perspective, but from the below points one should be able to figure it out:

1. User provisioning/De-provisioning – this activity, which takes anywhere from one day to three or four days manually, is done in minutes without any IT resource intervention and so increases efficiency and productivity


2. Notifications – respective stake holders/business owners are notified immediately upon an activity performed, and no follow-up emails or phone calls required


3. Data consistency – it helps to maintain data consistency in AD which eliminates a data clean-up activity which IT department has to undertake regularly


4. Data synchronization – it synchronizes data between HR application and AD/Exchange or other applications and AD/Exchange relieving HR and other application owners from day to day tasks of co-ordination or creating/modifying/deleting application user accounts


5. Automation – Most of the IT tasks are automated which in turn reduces work load on IT department. IT resources could be better utilized for some other useful activities

It’s a gentleman’s agreement.

Licensing is based on Enabled User Accounts in AD. This should include user accounts, application accounts and service accounts.Temporary accounts could be excluded, but no one from vendors really challenge the user count which the customer provides. Some customer’s find the price bit on higher side but, for me, the price is competitive compared to other products with similar functionality and considering the ROI.

The product functionality does not cease if the customer exceeds the license count. The vendor does not want to force the customer to stop using the product if the license count increases. Instead, customers can buy additional licenses without hampering the day to day work.

We didn't evaluate other products.

This product has tremendous potential. It can be used to automate a lot of day to day activities. I always tell my customers, list down all your requirements, pain areas, and day to day tasks. Prioritize them, and use this tool to automate these tasks as per priority.

When a new employee is hired, we create a new Active Directory (AD) user in a related department (Organizational Unit) with a random generated password, then give that user some AD rights. Also, we create an exchange mail user for this user on cloud or on-prem and inform that user by sending a notification mail or SMS. We did similar things in other systems and did all the process manually before Active Roles. That means lots of workload and manual processes. Active Roles provided us to do all these operations automatically and reduced our workload very significantly.

• It provides automatic provisioning/update/deprovisioning workflows from a source system to a target system.
• It allows you to easily monitor all workflow processes.
• It has very powerful native policies and scripts, which allow you to create your own custom policies, scripts, and virtual attributes.
• In addition to using the console (MMC interface), it also gives you management from the web interface.

For ActiveRoles, it would be good if the product supports multi-scripting language. You can use only VBScript.

VB.net , C#, or Powershell scripting would be a good choice for the product.

No issues.

No issues.

Technical support replies really promptly. The support team is very experienced and focused on the product. On the other hand, there is a community portal and you can find every piece of knowledge on there.

We have not used any similar products before. We did all related operations manually.

It was very straightforward.

The licensing model is a simple user-based model, not that much complicated.

We evaluated and researched other options, such as NetIQ, FIM, Oracle, CA, IBM, and SailPoint.

However, Active Roles is most suitable for us.

It is very important to come together with system owners who will be integrated at the beginning of the project to clarify all the rules and determine the work to be done. Test environments of the systems to be integrated must be requested. Test environments are so necessary.

• Automation of manual identity management operations (provisioning and deprovisioning).
• Solving security and compliance issues is easy.
• Operational issues are much easier and more reliable with Quest ActiveRoles's directory layer and portal.

It provides automatic provisioning for many applications and systems, including in-house applications and cloud applications. Also, it offers a virtual directory structure and a new directory layer between users and physical directories. Management and monitoring become easier.

Scripting options in different languages.

Not yet.

No.

It is excellent. Quick and useful answers.

They also have a large community portal where you can find a lot of information.

I didn't use any other solution, but I evaluated many solutions.

It was simple. I didn't have a problem. It took half a day.

There is a simple user-based licensing model. Not complicated.

Yes. NetIQ, FIM, Oracle, CA, IBM, and SailPoint.

Choose your project team well. Remember that analysis of all processes is very important. Don't forget that testing is also very important after each development.

I have been using One Identity Active Roles for approximately three to four years as a part of my role as a Senior System Administrator, where I gain hands-on experience in implementing and managing One Identity Active Roles for centralized Active Directory administration, including creating and managing access templates, configuring role-based access control, automating user provisioning and de-provisioning processes, setting up approval workflows, enforcing policies, and delegating administrative tasks securely, along with troubleshooting synchronization issues and integration with existing AD infrastructure to ensure compliance, operational efficiency, and reduced manual effort in a large enterprise environment.

My main use case for One Identity Active Roles is to centralize and streamline Active Directory administration by implementing secure delegation, automation, and governance control, where I primarily use it for automated user provisioning and de-provisioning based on HR triggers, applying role-based access control through access templates, enforcing naming and attribute policies, and managing group membership dynamically, along with configuring approval workflows for sensitive access requests to ensure compliance and audit readiness, while also reducing manual intervention for service desk teams when delegated limited administrative rights through One Identity Active Roles by giving direct access to the domain controller, thereby improving security and operational efficiency and consistency across the enterprise environment.

In my daily work, I use One Identity Active Roles to automate user onboarding and offboarding processes, where new users are automatically created with correct permissions, group memberships, and policies based on their role, and during offboarding, accounts are disabled and access removed instantly, which helps me to reduce manual effort, improve accuracy, and ensure better security and compliance.

The best features of One Identity Active Roles that stand out to me are mainly automation, delegation, and policy enforcement, as these provide me the most value in a real-world environment, where automation helps in streamlining user provisioning, de-provisioning, and group management through workflows, significantly reducing manual effort and errors, while fine-grained delegation allows secure role-based access control so that service desk or junior admins can perform limited tasks without giving full domain access, improving security and reducing the risk of privilege misuse, and policy enforcement ensures that all objects follow predefined standards like naming conventions, mandatory attributes, and compliance rules, maintaining consistency across the environment, along with strong workflow management and approval processes for sensitive changes, dynamic group management, and detailed auditing and reporting that help track every change for compliance and security purposes, making One Identity Active Roles a powerful tool for centralized, secure, and efficient identity and access management.

One feature that I feel is not highlighted enough is the powerful auditing and reporting capability in One Identity Active Roles, which provides detailed tracking of every change made within the Active Directory through One Identity Active Roles, including who performed the action, what changes were made, and when, making it extremely useful for compliance, security investigation, and troubleshooting, and in addition, the ability to customize workflows and scripts using PowerShell integration is also very valuable as it allows extending functionality based on business requirements, automate complex tasks, and integrate with other system solutions more adaptively to different needs.

In our organization, One Identity Active Roles is deployed in a hybrid environment, where the core One Identity Active Roles components such as the administration service and management console are hosted on-premises within our data center for better control and security, while it also integrates with cloud services like Azure AD to support hybrid identity and access scenarios, allowing us to manage both on-premises and cloud-based identities centrally, which provides flexibility, scalability, and aligns with our organization's gradual cloud adoption strategy.

One Identity Active Roles can be improved by enhancing its user interface to make it more modern and intuitive, as sometimes navigation and configuration feel complex for new users, and additionally, improving reporting and dashboard capabilities with more customizable and real-time analytics would add significant value, while better native integration with cloud platforms like Azure AD and hybrid environments could also strengthen support for evolving infrastructure needs, and simplifying workflow design with more visual and user-friendly options, along with improved performance during large-scale operations, would make it even more efficient and easier to manage the enterprise environment.

One specific issue I have encountered recently is that the interface and workflow configuration can become complex and less intuitive, especially when managing multiple approval steps or modifying existing workflows, which sometimes requires deeper scripting or backend adjustments, so more user-friendly and visual workflow design would be a great improvement, and as a wish-list item, I would like to see stronger, more seamless integration with cloud and hybrid environments like Azure AD, along with enhanced real-time reporting dashboards and easier troubleshooting tools, which would help in faster issue resolution and a better overall administration experience.

I have been working in my current field for the last 12 years.

One Identity Active Roles is a very stable and reliable solution in our experience, as it runs reliably in production with minimal downtime and handles large-scale Active Directory environments efficiently, provided it is properly configured and maintained, and we have seen consistent performance in day-to-day operations like provisioning, delegation, and policy enforcement without major issues.

One Identity Active Roles scales very well as the organization grows, as it is designed for enterprise environments and can handle a large number of users, groups, and directory objects efficiently, and in our experience, it has supported increasing workloads without performance issues, especially due to its centralized management, automation, and role-based delegation model, which allows us to scale the system to manage more identities without adding proportional administrative effort, and it also supports hybrid environments like on-premises and cloud integration, making it flexible for expansion based on industry needs where organizations have reported scalability issues and that continue to perform reliably as the user base and infrastructure grow.

My experience with customer support for One Identity Active Roles has been generally positive, as the support team is technically strong and responsive in handling issues in most cases, and they provide clear guidance and effective solutions.

Before implementing One Identity Active Roles, we were primarily using native Active Directory tools along with manual processes and some basic PowerShell scripts for user and group management, but we switched to One Identity Active Roles because those methods were time-consuming, error-prone, and lacked proper governance, delegation, and auditing capabilities, and as the organization grew, it became difficult to manage the identity life cycle efficiently, so we needed a centralized solution that could provide automation, role-based delegation, policy enforcement, and detailed auditing, which One Identity Active Roles delivered efficiently, helping us standardize processes, improve security, and reduce operational overhead.

I would say the integration of One Identity Active Roles with our existing IT infrastructure and directory services was moderately easy, as it integrates quite well with Active Directory out of the box and aligns with the standard Microsoft environment, so the initial setup and synchronization were straightforward, but some complexity came in when configuring advanced workflows, custom policies, and integration with the hybrid environment like Azure AD, which required careful planning, scripting, and testing, so overall, it was manageable with good documentation and experience, but not completely plug-and-play for more advanced use cases.

We have definitely seen a strong return on investment after implementing One Identity Active Roles, mainly in terms of time saving, reduced workload, and improved efficiency, where user provisioning and access requests that earlier took hours are now completed in a few minutes through automation, and we observe around a 40 to 50% reduction in service desk tickets related to Active Directory tasks, which allows the team to focus on more critical activities instead of repetitive work, while delegation reduces dependency on senior administrators, indirectly saving manpower effort, and overall, the reduction in errors, faster onboarding, and improved compliance also contribute to cost savings and operational efficiency, making it a valuable investment for the organization.

My experience with pricing, setup cost, and licensing for One Identity Active Roles has been that it is on the higher side compared to native tools, as it follows an enterprise licensing model, typically based on the number of managed users or accounts, but the cost is justified by the value it delivers in terms of automation, security, compliance, and reduced operational overhead, while the initial setup cost includes infrastructure implementation and possible professional services, which require some planning and investment, and licensing management can be a bit complex depending on the organization's size and requirements, but overall, it is considered a worthwhile investment for large environments where efficiency, governance, and scalability are critical.

Before selecting One Identity Active Roles, we evaluated solutions such as Microsoft Identity Manager and SailPoint IdentityIQ, but we chose One Identity Active Roles because it provided a better balance of ease of deployment, strong Active Directory integration, effective delegation, and built-in automation, specifically tailored for our AD environment.

My main use case for One Identity Active Roles is to centralize and streamline Active Directory administration by implementing secure delegation, automation, and governance control, where I primarily use it for automated user provisioning and de-provisioning based on HR triggers, applying role-based access control through access templates, enforcing naming and attribute policies, and managing group membership dynamically, along with configuring approval workflows for sensitive access requests to ensure compliance and audit readiness, while also reducing manual intervention for service desk teams when delegated limited administrative rights through One Identity Active Roles by giving direct access to the domain controller, thereby improving security and operational efficiency and consistency across the enterprise environment.

One specific issue I have encountered recently is that the interface and workflow configuration can become complex and less intuitive, especially when managing multiple approval steps or modifying existing workflows, which sometimes requires deeper scripting or backend adjustments, so more user-friendly and visual workflow design would be a great improvement, and as a wish-list item, I would like to see stronger, more seamless integration with cloud and hybrid environments like Azure AD, along with enhanced real-time reporting dashboards and easier troubleshooting tools, which would help in faster issue resolution and a better overall administration experience.

I would rate this product an 8 out of 10.